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(54) System and method for detecting cloning fraud in cellular PCS communications 



(57) A system and method for proactively detecting 
cloning fraud in a cellular mobile telephone environment 
are discussed. Information is collected which corre- 
sponds to registration notifications of the cellular tele- 
phones as they operate within the cellular mobile tele- 
phone environment. The registration information is used 
to detect time-space peculiarities. Specifically, registra- 



tions having the same mobile identification number and 
occurring in different mobile switching centers within a 
predetermined time interval are identified. This time in- 
terval, based on a reasonable travel time between cells 
covered by the different mobile switching centers where 
the registrations originated, is used as a threshold for 
detecting cloning fraud. 
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Description 

Background of the Invention 

1 . Field of the Invention 

The present invention relates generally to cellu- 
lar/PCS (Personal Communications Services) tele- 
phone communications. Specifically, the present inven- 
tion relates to detecting cloning fraud in a cellular/PCS 
environment. 

2. Related Art 

Cellular mobile telephone systems provide direct- 
dial telephone service to mobile users by using radio 
transmission. The service area of a cellular mobile tel- 
ephone system is divided into regions called cells. With- 
in each cell is a base station which includes a transmitter 
and a receiver. Each base station is connected to a mo- 
bile switching center (MSC) which processes calls to 
and from mobile users located in the cell. Each trans- 
mitter and receiver operates on a voice channel (fre- 
quency). A single channel may be used for many simul- 
taneous conversations (voice signals) in cells which are 
sufficiently separated from one another such that exces- 
sive interference is avoided. However, as the number of 
mobile users increases within a cell, the cell may be- 
come too crowded to provide adequate separation. 
When a cell becomes overcrowded, the cell must be 
split into smaller cells with each cell covering a smaller 
geographic area. Each new cell requires a new base 
station which is connected to the original MSC. Thus, 
as the number of cells increases, each MSC may be 
processing calls for multiple cells. 

As a mobile user travels with his cellular telephone 
powered up, the cellular telephone autonomously reg- 
isters the mobile user by sending signals with informa- 
tion identifying the mobile user to the MSC serving the 
cell where the mobile user is currently located. The 
sending and receipt of such information is referred to as 
registration notification. The information included in a 
registration notification is the mobile user's mobile iden- 
tification number (MIN) and an electronic serial number 
(ESN). The MIN uniquely identifies each mobile user in 
a manner similar to a conventional telephone number. 
The ESN is encoded into each cellular telephone. The 
ESN functions as a security password verifying the va- 
lidity of the MIN and allowing the mobile user access to 
the cellular mobile telephone system. 

The MSC collects registration notifications and pro- 
vides them to other facilities in the cellular mobile tele- 
phone system. These facilities primarily use the regis- 
tration notifications to facilitate incoming and outgoing 
calls. Typically, a mobile user subscribes for services 
with the MSC covering the cell, or group of cells, where 
the mobile user primarily resides or conducts business. 
This MSC is referred to as the mobile user's home MSC. 



All other MSCs in the cellular mobile telephone system 
are known as visited MSCs with respect to the mobile 
user. When a mobile user ventures beyond the cells cov- 
ered by the home MSC, the mobile user is said to be 
s "visiting." For purposes of this discussion, a mobile user 
inside a cell of a visited MSC is referred to as a visiting 
mobile user. 

When a mobile user powers on his cellular tele- 
phone or crosses cell boundaries covered by different 

10 MSCs, the cellular telephone, at some point, autono- 
mously sends a signal representing a registration noti- 
fication. The MSC covering the cell (i.e., either a home 
MSC or a visited MSC) receives the registration notifi- 
cation. Based on the MIN and ESN contained in the reg- 

is istration notification, the MSC queries a Roamer Valida- 
tion and Call Delivery (RVCD) facility to validate the mo- 
bile user's subscription information. The RVCD stores 
the subscription information for all mobile users in the 
cellular mobile telephone system in a Home Location 

so Register (HLR). The HLR identifies each of the mobile 
users home MSC, the services to which each mobile 
user is subscribed, and whether each subscription is 
valid. 

After receiving a query from the MSC, the RVCD 

2S responds by sending the requested the information in- 
cluded in the HLR back to the querying MSC. The MSC 
maintains this information to provide cellular mobile tel- 
ephone services to the mobile user as long as the mobile 
user remains in cells covered by the MSC. 

so Registration notification is important for several rea- 
sons. Primarily, registration notification is used to pro- 
vide cellular mobile telephone services to mobile users 
outside of the cells of the home MSC (as described 
above). Thus, a mobile user can utilize cellular mobile 

35 telephone services throughout the cellular mobile tele- 
phone system. 

Registration notification is also important for routing 
incoming calls to mobile users. When an incoming call 
is to be routed to a mobile user, the mobile user must 

40 be located so that the call can be routed through the 
proper MSC to the mobile user. In the case of a conven- 
tional telephone user (i. e., not a mobile user) attempting 
to place a call to a mobile user, the home MSC receives 
the incoming call from the regular telephone user and 

ts determines whether the mobile user is active, or oper- 
ating, in the cell of the home MSC. If the mobile user is 
not active within the cell of the home MSC, the mobile 
user may: 1 ) not have his telephone powered up, or 2) 
be active in the cell of a visited MSC. In the first case, 

so the incoming call cannot be routed to the mobile user. 
In the second case, the RVCD attempts to locate the 
mobile user within the cellular telephone system. 

The RVCD functions as a clearing house for a cel- 
lular mobile telephone system. Specifically, the RVCD 

ss validates mobile users and manages activation, deacti- 
vation, and changes in subscription profiles of mobile 
users. The RVCD also stores a copy of each registration 
notification received from the MSCs. Furthermore, the 
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RVCD updates the HLR to indicate the MSC where the 
latest registration notification originated (this is called 
the originating MSC). This allows the RVCD to track 
where each mobile user is currently located in the cel- 
lular mobile telephone system. s 

Tracking mobile users within the cellular mobile tel- 
ephone system serves to facilitate the routing of incom- 
ing calls to mobile users. When an incoming call is 
placed to a mobile user who is not within the cell of the 
home MSC, the home MSC can query the RVCD to lo- io 
cate the mobile user based on the origination of the reg- 
istration notification maintained in the HLR. The the in- 
coming call can then be routed to the originating MSC 
which connects the incoming call via radio communica- 
tion signals to the mobile user. In the preferred embod- is 
iment, two RVCD systems are used in parallel to provide 
backup for the cellular mobile telephone system in case 
one RVCD should fail. 

A problem existing in current cellular mobile tele- 
phone systems is cloning fraud. Cloning fraud occurs z° 
when one mobile user (called an unauthorized user) ob- 
tains and fraudulently uses the MIN and ESN registered 
to another mobile user (called an authorized user) in or- 
der to obtain "free" service. As used herein, the term 
"valid MIN" refers to a MIN when being used by an au- zs 
thorized mobile user. The term "cloned MIN" refers to a 
MIN when being used by an unauthorized mobile user. 

The cellular mobile telephone system uses the MIN 
and ESN associated with each mobile telephone call to 
bill the authorized mobile user registered with that MIN 30 
and ESN. When a MIN and ESN are "cloned", the au- 
thorized mobile user gets billed for calls made with the 
valid MIN and well as those calls made using the cloned 
MIN. Cloning fraud costs the cellular telephone industry 
millions of dollars in lost revenue each year. What is 35 
needed is a means for detecting cloning fraud in a cel- 
lular/PCS environment. 

Summary of the Invention 

40 

The present invention is directed to a system and 
method for proactively detecting cloning fraud in a cel- 
lular/PCS (Personal Communications Services) envi- 
ronment. According to the invention, the system detects 
cloning fraud by comparing the time and location of reg- *s 
istration notifications having the same mobile identifica- 
tion number (MIN). Cloning fraud is reported when the 
computed time difference between such registration no- 
tifications is less than a reasonable travel time between 
the cells of the originating mobile switching centers so 
(originating MSCs). 

Further features and advantages of the present in- 
vention, as well as the structure and operation of various 
embodiments of the present invention, are described in 
detail below with reference to the accompanying draw- ss 
ings. 



Brief Description of the Drawings 

The present invention is described with reference 
to the accompanying drawings. In the drawings, like ref- 
erence numbers indicate identical or functionally similar 
elements. Additionally, the left-most digit(s) of a refer- 
ence number identifies the drawing in which the refer- 
ence number first appears. 

FIG. 1 illustrates a cellular mobile telephone envi- 
ronment; 

FIG. 2 illustrates a block diagram of a cellular mobile 
telephone system according to a preferred embod- 
iment of the present invention; 
FIG. 3 illustrates a block diagram of a clone detec- 
tion system (CDS) according to a preferred embod- 
iment of the present invention; 
FIGS. 4 and 5 are flow charts depicting the pre- 
ferred operation of the present invention; and 
FIG. 6. illustrates an example clone detection table 
used by the invention. 

Detailed Description of the Embodiments 

FIG. 1 illustrates a cellular mobile telephone envi- 
ronment 100. Cellular mobile telephone environment 
100 includes a plurality of cells 110. Each cell 110 in- 
cludes a base station (not shown) for transmitting and 
receiving radio signals to and from mobile users 1 30. 
Each base station is connected to a mobile switching 
center (MSC) 120. One or more mobile users 130 may 
be positioned in each cell 110 at any time. For ease of 
discussion, it is assumed that each MSC 1 20 is connect- 
ed to one base station, and that each MSC 120 covers 
one cell 110. However, it will be apparent to one skilled 
in the art that such a limitation is unnecessary. In fact, 
each MSC 1 20 is usually connected to several base sta- 
tions, and thus, is responsible for covering multiple cells 
110. 

FIG. 2 illustrates a blockdiagram of a cellular mobile 
telephone system 200 according to a preferred embod- 
iment of the present invention. Cellular mobile tele- 
phone system could comprise a nationwide telephone 
system. Cellular mobile telephone system 200 includes 
a PCS Service Management System (PSMS) 202, a first 
Roamer Validation and Call Delivery system (RVCD) 
204A, a second RVCD 204B, a plurality of MSCs 1 20, 
and a plurality of mobile users 1 30. As discussed above, 
a base station (not shown) is positioned in each cell 110. 
Each base station is connected to a MSC 1 20. An MSC 
1 20 may be connected to one or more base stations thus 
covering one or more cells 110. Each of the MSCs 120 
is connected to either RVCD 204A or RVCD 204B, 
which are centrally located within cellular mobile tele- 
phone system 200. The RVCDs 204 are connected to 
each other to provide rerouting in the event that one 
fails. Both RVCDs 204 are connected to PSMS 202 
which is also centrally located within cellular mobile tel- 



5 



EP 0 714 219 A2 



6 



ephone system 200. In the preferred embodiment, the 
MSCs 120 are connected to the RVCDs 204 using IS- 
41 protocol over SS7 or X.2S. The RVCDs 204 are con- 
nected to the PSMS 202 via an X.25 packet network. A 
person skilled in the art will recognize that other connec- s 
tion protocols and networks may alternatively be used. 

In general, a mobile user 1 30 registers with a MSC 
120 by sending its MIN and ESN using well known wire- 
less communication techniques (i.e., via a radio signal 
220). Radio signal 220 containing mobile user's MIN and io 
ESN is sent at a predetermined time interval while the 
mobile user 130 is operating to notify the MSC 120 of 
its presence within the cell 110 where the MSC 120 is 
located. This is referred to as registration notification. 
The MSC 1 20 receives the radio signal 220 as a regis- is 
tration notification (REGNOT) query. A REGNOT query 
includes a MIN, a time stamp representing a time when 
the registration notification was received by the MSC 
120, and an originating MSC indicia identifying which 
MSC 120 received the registration notification. The so 
MSC 120 sends the REGNOT query to one of the 
RVCDs 204 which processes the REGNOT query and 
creates a record of the query for subsequent retrieval 
by PSMS 202 (described below). 

For example, at 10:30 am, a mobile user 130G op- 25 
erating in a cell 110G sends a radio signal 220 contain- 
ing a registration notification. The MSC 120G receives 
the signal 220 and creates a REGNOT query. The REG- 
NOT query includes the mobile user 1 30G's Ml N, a time 
stamp of 10:30 am (i.e., the time when the registration so 
notification was received), and an originating MSC indi- 
cia identifying MSC 120G (i.e., the identity of the MSC 
receiving the registration notification). The REGNOT 
query is sent to either RVCD 204A or RVCD 204B which 
stores the query as a REGNOT record. ss 

As discussed previously, each RVCD 204 functions 
as a clearing house for the cellular mobile telephone 
system 200 by maintaining information regarding the 
mobile users 1 30. This information includes the cellular 
mobile telephone services to which each mobile user 40 
1 30 subscribes and the cell where each operating mo- 
bile user 1 30 is currently located. RVCDs 204 maintain 
this information in a master list referred to as a Home 
Location Register (HLR). The information regarding the 
cell where each operating mobile user 130 is currently 4S 
located is updated from REGNOT queries received from 
the MSCs 1 20. At a predetermined time interval (i.e. de- 
termined by individual system implementation require- 
ments), each RVCD 204 sends the REGNOT records to 
the PSMS 202 which performs various processing of the so 
information. The PSMS 202 includes a clone detection 
system (CDS) 210 which processes the REGNOT 
records to identify instances of cloning fraud. 

FIG. 3 illustrates a block diagram of the clone de- 
tection system (CDS) 210 according to a preferred em- S5 
bodiment of the present invention. The CDS 210 in- 
cludes a REGNOT record collector 302, a REGNOT 
record file 312, a fraud manager 304, a clone detection 



time table 306, a clone detection window 308, a clone 
record file 314, and a report generator 316. 

The PSMS 202 receives the REGNOT records, in- 
dicated by reference number 318 in FIG. 3, from the 
RVCDs 204. The REGNOT record collector 302 collects 
these REGNOT records 318 and stores them in the 
REGNOT record file 312. In the preferred embodiment, 
the PSMS 202 receives new REGNOT records 31 8 from 
the RVCDs 204 every thirty minutes. The REGNOT 
records 318 received during each thirty minute interval 
are stored in the REGNOT record file 312 as a group. 
Each group of REGNOT records 318 so stored is re- 
ferred to as a "half hour data group" 310. 

Fraud manager 304 collects several half hour data 
groups 31 0 from the REGNOT record file 31 2 and forms 
a clone detection window 308 (such half hour data 
groups 310 are stored in memory, such as random ac- 
cess memory). The clone detection window 308 collec- 
tively represents all registration notifications (represent- 
ed by REGNOT records 31 8) received by the MSCs 1 20 
within the cellular mobile telephone system 200 during 
a predetermined time frame. In the preferred embodi- 
ment, the fraud manager 304 forms a clone detection 
window 308 from the most recent thirteen half hour data 
groups 310 arranged from oldest in time to newest in 
time. Accordingly, the clone detection window 308 rep- 
resents all registration notifications received within the 
past 6.5 hours by all MSCs 120 in the cellular mobile 
telephone system 200. 

Clone detection window 308 is a sliding window, 
representing registration notifications occurring within a 
specified time interval (i.e. the last 6.5 hours). As the 
window "slides" (i.e. time passes), new registration no- 
tifications are added to the window and old ones are re- 
moved. Thus, only those registration notifications occur- 
ring within the specified time interval are processed to- 
gether by fraud manager 304. 

The fraud manager 304 determines whether cloning 
fraud exists by determining whether time-space peculi- 
arities exist within the clone detection window 308. A 
time-space peculiarity exists when registration notifica- 
tions with the same MIN originated in different locations 
within a time insufficient to travel between the different 
locations. In such cases, at least one of the registration 
notifications is likely to be an instance of cloning fraud. 

In the preferred embodiment, the fraud manager 
304 detects cloning fraud by comparing the difference 
between the time stamps of the REGNOT records 318 
in the clone detection window 308 having the same MIN 
with a reasonable travel time between the locations of 
the cells of the originating MSCs. For example, referring 
to FIG. 1, suppose the MSC 120A receives a registration 
notification indicating a MIN of X from the mobile user 
130Aat 10:00 a.m. Later, the MSC 120C receives a reg- 
istration notification also indicating a MIN of X from the 
mobile user 130Cat 10:45 a.m. Suppose that a reason- 
able travel time between cell 11 OA and cell 110C is 80 
minutes. When the fraud manager 304 processes the 
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REGNOT records 318 in the clone detection window 
310, it will locate these two registration notifications hav- 
ing the same MIN of X. The fraud manager 304 will de- 
termine that one registration notification was received 
by the MSC 120A in cell 11 OA while the other was re- s 
ceived by the MSC 120C in cell 110C. The fraud man- 
ager 304 will determine that the registration notifications 
occurred 45 minutes apart from one another. By com- 
paring this time difference (45 minutes) with the reason- 
able travel time (80 minutes), the fraud manager 304 will »o 
conclude that an instance of cloning fraud has occurred. 

The previous example has been provided to illus- 
trate the operation of the clone detection system 210 
and not as a limitation. In the preferred embodiment, the 
clone detection window 308 is 6.5 hours wide (chosen is 
as the minimum reasonable time to travel across the 
United States) and encompasses a much larger time 
frame than the example illustrates. Furthermore, it 
would be apparent for one skilled in the art to adjust the 
width of the clone detection window 308 depending on so 
the geographic area covered by the cellular mobile tel- 
ephone system 200. 

Referring again to FIG. 3, in the preferred embodi- 
ment, reasonable travel times between the ceils 110 
covered by different MSCs 1 20 of the cellular mobile tel- ss 
ephone system 200 are stored in a clone detection time 
table 306. The clone detection time table 306 includes 
the reasonable travel time between cells 110 covered 
by a pair of MSCs 1 20. For cells 110 covered by a pair 
of adjacent MSCs 120 (e.g., MSC 120A and MSC 30 
120B), the travel time is zero because a mobile user 130 
could register with either MSC 120 as the mobile user 
1 30 crosses cell boundaries. For each pair of nonadja- 
cent MSCs 1 20 (e.g. , MSC 1 1 0A and MSC 1 1 0D), a rea- 
sonable travel time is determined based on the time a ss 
mobile user 1 30 would take to travel out of cells 1 1 0 cov- 
ered by a first MSC 1 20 and into cells 1 1 0 covered by a 
second MSC 120. This reasonable travel time is stored 
in clone detection time table 306 and is retrieved using 
the originating MSC from each of the REGNOT records 40 
as indices into the table. An example clone detection 
time table 306 is illustrated in FIG. 6. For example, the 
reasonable travel time between cells 110 covered by 
MSCs 120A and 120D is found by using the first REG- 
NOT originating MSC as MSC A and the second REG- 
NOT originating MSC as MSC D to retrieve 1 20 minutes 
as the reasonable travel time. 

The preferred embodiment uses RVCDs 204 to 
store the HLR and collect the REGNOT queries for each 
of the MSCs 110. One skilled in the art would recognize so 
that other implementations or divisions of processing 
could be utilized for clone detection system 210. For ex- 
ample, the PSMS 202 could be directly connected to 
each MSC 110 and handle the registration notifications 
without any RVCDs 204. Furthermore, data could be ss 
processed in other that half hour increments, or in fact, 
immediately upon receipt. 

FIG. 4 illustrates a flow diagram of a preferred im- 



plementation of the processing performed by the fraud 
manager 304 during clone detection. In a step 402, the 
fraud manager 304 forms a clone detection window 308 
from preferably the most recent in time thirteen half hour 
data groups 310 retrieved from REGNOT record file 
312. As discussed above, the data is arranged from the 
oldest REGNOT record to the newest REGNOT record. 

In a step 404, the fraud manager 304 reads a MIN 
from a first REGNOT record 318, (i.e., the oldest record 
with respect to time) in the clone detection window 308. 
In a step 406, the fraud manager 304 reads a MIN from 
a second REGNOT record 318 in clone detection win- 
dow 308. In a decision step 408, the fraud manager 304 
compares the MIN from the first REGNOT record with 
the MIN from the second REGNOT record to determine 
if the MINs are the same. If the MINs are the same (in- 
dicating the same registered mobile user), processing 
continues at a step 410; otherwise, processing contin- 
ues at a decision step 414. 

In step 410, the fraud manager 304 handles a pos- 
sible clone detection, as discussed in greater detail be- 
low. After handling a possible clone detection, the fraud 
manager 304, in a step 412, notes that it should use the 
second REGNOT record in place of the first REGNOT 
record in future performances of step 408 and 410, so 
that future occurrences of the same MIN will be com- 
pared (in step 502, as described below) with the time 
stamp of the second REGNOT record rather than that 
of the first. 

In decision step 414, the fraud manager 304 deter- • 
mines whether the entire clone detection window 308 
has been searched for the occurrence of the MIN ob- 
tained in step 404. If the entire clone detection window 
308 has been searched, processing continues at a step 
41 6; otherwise, processing returns to step 406 to get a 
new second REGNOT record 31 8 from the clone detec- 
tion window 308 and continue searching for the same 
MIN. 

In step 416, the fraud manager 304 excludes from 
further consideration all REGNOT records 318 having 
the MIN obtained in step 404. In a step 418, the fraud 
manager 304 determines whether any REGNOT 
records 318 remain in the clone detection window 308 
that contain MINs that have not yet been checked for 
cloning fraud. If no REGNOT records 318 remain to be 
checked, processing ends in a step 420; otherwise, 
processing returns to step 404 to get a new first REG- 
NOT record 31 8 containing a new MIN to check for clon- 
ing fraud. 

FIG. 5 illustrates the handling of possible clone de- 
tection of step 410 in greater detail. In a step 502, the 
fraud manager 304 computes a difference between time 
stamps of the first and second REGNOT records. In a 
step 504, the fraud manager 304 obtains the indicia 
identifying the originating MSCs from the first and sec- 
ond REGNOT records and uses them as indices to the 
clone detection time table 306 to retrieve a reasonable 
travel time between the respective cells of originating 
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MSCs. In a decision step 506, the fraud manager 304 
determines whether the time stamp difference obtained 
in step 502 is less than the reasonable travel time ob- 
tained from the clone detection time table 308 in step 
504. If the time stamp difference is less than the reason- 
able travel time, then cloning fraud is likely to exist and 
processing continues at a step 508; otherwise, the han- 
dling of possible clone detection is complete (i.e., clon- 
ing fraud does not exist) and processing continues at 
step 412. 

In step 508, the fraud manager 304 records a likely 
instance of cloning fraud in the clone record file 31 4. The 
fraud manager stores the MIN, both originating MSCs, 
the clone detection time, and the time stamp difference 
for later action/reporting by the clone detection system 
210. In addition to a daily report of cloning activity, such 
action/reporting may include an alarm displayed to per- 
sonnel in cellular mobile telephone system 200 or re- 
moval of the suspected clone from service. After step 
508, processing continues at step 412. 

While the invention has been particularly shown 
and described with reference to several preferred em- 
bodiments thereof, it will be understood by those skilled 
in the art that various changes in form and details may 
be made therein without departing from the spirit and 
scope of the invention as defined in the appended 
claims. 



is 
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Claims 

1 . A method for proactively detecting cloning fraud in 
a mobile cellular telephone environment, compris- 
ing the steps of: 

(1) collecting a plurality of registration notifica- 
tions each represented by a registration notifi- 
cation (REGNOT) record comprising a mobile 
identification number (MIN), a time stamp of 
said registration notification, and originating 
indicia identifying a cell where said registration 
notification originated; 

(2) detecting a first REGNOT record and a sec- 
ond REGNOT record having a common MIN; 

(3) computing a time difference between time 
stamps of said first and second REGNOT 7. 
records; and 

(4) determining that cloning fraud involving said 
common MIN has likely occurred based on said 

time difference. s° 8. 

2. The method of claim 1 , wherein step (4) comprises 
the step of comparing said time difference to a clone 
detection time corresponding to a reasonable time 
needed to travel between cells identified by origi- ss 
nating indicias contained in said first and second 
REGNOT records. 
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The method of claim 2, wherein said clone detection 
time is stored in a clone detection time table and 
retrieved using said originating indicias contained 
in said first and second REGNOT records as indices 
into said clone detection time table. 

A method for proactively detecting cloning fraud in 
a mobile cellular telephone environment, compris- 
ing the steps of: 

(1 ) storing a plurality of registration notifications 
each represented by a registration notification 
(REGNOT) records, each REGNOT record 
comprising a mobile identification number 
(MIN), a time stamp of said registration notifi- 
cation, and originating indicia identifying a cell 
where said registration notification originated; 

(2) forming a clone data window comprising a 
plurality of said REGNOT records occurring 
within a predetermined time frame; 

(3) detecting in said clone data window a first 
REGNOT record and a second REGNOT 
record having a common MIN; 

(4) computing a time difference between time 
stamps of said first and second REGNOT 
records; 

(5) determining that cloning fraud involving said 
common MIN has likely occurred based on said 
time difference; and 

(6) recording said likely occurrence of cloning 
fraud involving said common MIN. 

The method of claim 4, wherein step (5) comprises 
the step of comparing said time difference to a clone 
detection time corresponding to a reasonable time 
needed to travel between cells identified by origi- 
nating indicias contained in said first and second 
REGNOT records. 

The method of claim 5, wherein said clone detection 
time is stored in a clone detection time table and 
retrieved using said originating indicias contained 
in said first and second REGNOT records as indices 
into said clone detection time table. 

The method of claim 6, wherein said clone detection 
window is formed every 30 minutes and said pre- 
determined time frame is the previous 6.5 hours. 

A computer-based system for proactively detecting 
cloningfraud in a mobilecellulartelephone environ- 
ment, comprising: 

storing means for storing a plurality of registra- 
tion notifications each represented by a regis- 
tration notification (REGNOT) record, each 
REGNOT record comprising a mobile identifi- 
cation number (MIN), a time stamp of said reg- 
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istration notification, and originating indicia 
identifying a cell where said registration notifi- 
cation originated; 

detecting means for detecting a first REG NOT 
record and a second REGNOT record having a s 
common MIN; 

computing means for computing a time differ- 
ence between time stamps of said first and sec- 
ond REGNOT records; 

meansfordeterminingthatcloningfraud involv- io 
ing said common MIN has likely occurred 
based on said time difference; and 
reporting means for reporting said likely occur- 
rence of cloning fraud involving said common 
MIN. 15 

9. The system of claim 8, wherein said means for 
determining cloning fraud comprises comparing 
said time difference to a clone detection time corre- 
sponding to the reasonable time needed to travel 20 
between cells identified by originating indicias con- 
tained in said first and second REGNOT records. 

1 0. The system of claim 9, wherein said clone detection 
time is stored in a clone detection time table and 25 
retrieved using said originating indicias contained 

in said first and second REGNOT records as indices 
into said clone detection time table. 
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(57) A system and method for proactively detecting 
cloning fraud in a cellular mobile telephone environment 
are discussed. Information is collected which corre- 
sponds to registration notifications of the cellular tele- 
phones as they operate within the cellular mobile tele- 
phone environment. The registration information is used 
to detect time-space peculiarities. Specifically, registra- 



tions having the same mobile identification number and 
occurring in different mobile switching centers within a 
predetermined time interval are identified. This time in- 
terval, based on a reasonable travel time between cells 
covered by the different mobile switching centers where 
the registrations originated, is used as a threshold for 
detecting cloning fraud. 
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